CVE-2026-45066: sensiolabs symfony Incomplete List of Disallowed Inputs

Vulnerability summary

CVE-2026-45066 is a medium (CVSS 6.1) Incomplete List of Disallowed Inputs vulnerability in sensiolabs symfony. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.9% of scored vulnerabilities.

Timeline

1. 14-07-2026
   PublishedVulnerability first disclosed.
2. 16-07-2026
   Last modifiedVulnerability information updated.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
• CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.